<!DOCTYPE html>
<html lang="en-US">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width" />
<title>Pitfalls of relying on eBPF for security monitoring (and some solutions) | Trail of Bits Blog</title>
<link rel="profile" href="http://gmpg.org/xfn/11" />
<link rel="pingback" href="https://blog.trailofbits.com/xmlrpc.php" />
<!--[if lt IE 9]>
<script src="https://blog.trailofbits.com/wp-content/themes/everyday/js/html5.js" type="text/javascript"></script>
<![endif]-->

<meta name='robots' content='max-image-preview:large' />
<!-- Jetpack Site Verification Tags -->
<meta name="google-site-verification" content="Lbyyor8qrpJf-6qi1ql45JDKAmXUIcc3N0mFeVNwUok" />
<link rel='dns-prefetch' href='//js.hs-scripts.com' />
<link rel='dns-prefetch' href='//secure.gravatar.com' />
<link rel='dns-prefetch' href='//stats.wp.com' />
<link rel='dns-prefetch' href='//fonts-api.wp.com' />
<link rel='dns-prefetch' href='//widgets.wp.com' />
<link rel='dns-prefetch' href='//jetpack.wordpress.com' />
<link rel='dns-prefetch' href='//s0.wp.com' />
<link rel='dns-prefetch' href='//public-api.wordpress.com' />
<link rel='dns-prefetch' href='//0.gravatar.com' />
<link rel='dns-prefetch' href='//1.gravatar.com' />
<link rel='dns-prefetch' href='//2.gravatar.com' />
<link rel='dns-prefetch' href='//i0.wp.com' />
<link rel='dns-prefetch' href='//c0.wp.com' />
<link rel="alternate" type="application/rss+xml" title="Trail of Bits Blog &raquo; Feed" href="https://blog.trailofbits.com/feed/" />
<link rel="alternate" type="application/rss+xml" title="Trail of Bits Blog &raquo; Comments Feed" href="https://blog.trailofbits.com/comments/feed/" />
<link rel="alternate" type="application/rss+xml" title="Trail of Bits Blog &raquo; Pitfalls of relying on eBPF for security monitoring (and some solutions) Comments Feed" href="https://blog.trailofbits.com/2023/09/25/pitfalls-of-relying-on-ebpf-for-security-monitoring-and-some-solutions/feed/" />
<script type="text/javascript">
/* <![CDATA[ */
window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/svg\/","svgExt":".svg","source":{"concatemoji":"https:\/\/blog.trailofbits.com\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.4.3"}};
/*! This file is auto-generated */
!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(n,0,0),new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data));return t.every(function(e,t){return e===r[t]})}function u(e,t,n){switch(t){case"flag":return n(e,"\ud83c\udff3\ufe0f\u200d\u26a7\ufe0f","\ud83c\udff3\ufe0f\u200b\u26a7\ufe0f")?!1:!n(e,"\ud83c\uddfa\ud83c\uddf3","\ud83c\uddfa\u200b\ud83c\uddf3")&&!n(e,"\ud83c\udff4\udb40\udc67\udb40\udc62\udb40\udc65\udb40\udc6e\udb40\udc67\udb40\udc7f","\ud83c\udff4\u200b\udb40\udc67\u200b\udb40\udc62\u200b\udb40\udc65\u200b\udb40\udc6e\u200b\udb40\udc67\u200b\udb40\udc7f");case"emoji":return!n(e,"\ud83e\udef1\ud83c\udffb\u200d\ud83e\udef2\ud83c\udfff","\ud83e\udef1\ud83c\udffb\u200b\ud83e\udef2\ud83c\udfff")}return!1}function f(e,t,n){var r="undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope?new OffscreenCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t.defer=!0,i.head.appendChild(t)}"undefined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.supportTests)return e.supportTests}catch(e){}return null}();if(!n){if("undefined"!=typeof Worker&&"undefined"!=typeof OffscreenCanvas&&"undefined"!=typeof URL&&URL.createObjectURL&&"undefined"!=typeof Blob)try{var e="postMessage("+f.toString()+"("+[JSON.stringify(s),u.toString(),p.toString()].join(",")+"));",r=new Blob([e],{type:"text/javascript"}),a=new Worker(URL.createObjectURL(r),{name:"wpTestEmojiSupports"});return void(a.onmessage=function(e){c(n=e.data),a.terminate(),t(n)})}catch(e){}c(n=f(s,u,p))}t(n)}).then(function(e){for(var t in e)n.supports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.supports.flag,n.DOMReady=!1,n.readyCallback=function(){n.DOMReady=!0}}).then(function(){return e}).then(function(){var e;n.supports.everything||(n.readyCallback(),(e=n.source||{}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);
/* ]]> */
</script>
<link rel='stylesheet' id='all-css-66c41b05190d34acca86abd2192dfb92' href='https://blog.trailofbits.com/_static/??-eJyNUltOAzEMvBDBBQmxP4ifShyAA6BsYqVu81KcdNnb4+0DtUtL++eJPeOxnSErk2LFWCH75igyrLFmbTYQkm0eGQp6XdGqnLjO0KNhfhj+SrgmsMfioG/kLfQ+mY3y1BddRuA6erxG9XpMrSpXyJ4XUjS+WfGzZghoSaPHMDFPQRY6FuXRaTM+Boo32ZI7xaeco7XQ1NHdkE0KvIItRpsK6FZT0LWSgYrfda+kBrIOq9q5ZxAxOLxMNfeuTPrkFKWC/9+XSbvlMvxOuMQs7jAaEvCRltraET73Zvba0wX5qpP5/cVJ2PtoPZtCuVKKSrLaKwkO6QvZext42uCVKetKrsKAWyyj1Te+zlyXV7qg3Y0/hRTdLeaXLBE4GZLRfHKJz8ClvzFXmK59iKfS9/D29LroXrrnbtH9ABNLUNg=' type='text/css' media='all' />
<style id='wp-block-library-inline-css'>
.has-text-align-justify{text-align:justify;}
</style>
<style id='wp-emoji-styles-inline-css'>

	img.wp-smiley, img.emoji {
		display: inline !important;
		border: none !important;
		box-shadow: none !important;
		height: 1em !important;
		width: 1em !important;
		margin: 0 0.07em !important;
		vertical-align: -0.1em !important;
		background: none !important;
		padding: 0 !important;
	}
</style>
<style id='jetpack-sharing-buttons-style-inline-css'>
.jetpack-sharing-buttons__services-list{display:flex;flex-direction:row;flex-wrap:wrap;gap:0;list-style-type:none;margin:5px;padding:0}.jetpack-sharing-buttons__services-list.has-small-icon-size{font-size:12px}.jetpack-sharing-buttons__services-list.has-normal-icon-size{font-size:16px}.jetpack-sharing-buttons__services-list.has-large-icon-size{font-size:24px}.jetpack-sharing-buttons__services-list.has-huge-icon-size{font-size:36px}@media print{.jetpack-sharing-buttons__services-list{display:none!important}}.editor-styles-wrapper .wp-block-jetpack-sharing-buttons{gap:0;padding-inline-start:0}ul.jetpack-sharing-buttons__services-list.has-background{padding:1.25em 2.375em}
</style>
<style id='classic-theme-styles-inline-css'>
/*! This file is auto-generated */
.wp-block-button__link{color:#fff;background-color:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}
</style>
<style id='global-styles-inline-css'>
body{--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color--pale-cyan-blue: #8ed1fc;--wp--preset--color--vivid-cyan-blue: #0693e3;--wp--preset--color--vivid-purple: #9b51e0;--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple: linear-gradient(135deg,rgba(6,147,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradient(135deg,rgba(252,185,0,1) 0%,rgba(255,105,0,1) 100%);--wp--preset--gradient--luminous-vivid-orange-to-vivid-red: linear-gradient(135deg,rgba(255,105,0,1) 0%,rgb(207,46,46) 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray: linear-gradient(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);--wp--preset--gradient--cool-to-warm-spectrum: linear-gradient(135deg,rgb(74,234,220) 0%,rgb(151,120,209) 20%,rgb(207,42,186) 40%,rgb(238,44,130) 60%,rgb(251,105,98) 80%,rgb(254,248,76) 100%);--wp--preset--gradient--blush-light-purple: linear-gradient(135deg,rgb(255,206,236) 0%,rgb(152,150,240) 100%);--wp--preset--gradient--blush-bordeaux: linear-gradient(135deg,rgb(254,205,165) 0%,rgb(254,45,45) 50%,rgb(107,0,62) 100%);--wp--preset--gradient--luminous-dusk: linear-gradient(135deg,rgb(255,203,112) 0%,rgb(199,81,192) 50%,rgb(65,88,208) 100%);--wp--preset--gradient--pale-ocean: linear-gradient(135deg,rgb(255,245,203) 0%,rgb(182,227,212) 50%,rgb(51,167,181) 100%);--wp--preset--gradient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-size--medium: 20px;--wp--preset--font-size--large: 36px;--wp--preset--font-size--x-large: 42px;--wp--preset--font-family--albert-sans: 'Albert Sans', sans-serif;--wp--preset--font-family--alegreya: Alegreya, serif;--wp--preset--font-family--arvo: Arvo, serif;--wp--preset--font-family--bodoni-moda: 'Bodoni Moda', serif;--wp--preset--font-family--cabin: Cabin, sans-serif;--wp--preset--font-family--chivo: Chivo, sans-serif;--wp--preset--font-family--commissioner: Commissioner, sans-serif;--wp--preset--font-family--cormorant: Cormorant, serif;--wp--preset--font-family--courier-prime: 'Courier Prime', monospace;--wp--preset--font-family--crimson-pro: 'Crimson Pro', serif;--wp--preset--font-family--dm-mono: 'DM Mono', monospace;--wp--preset--font-family--dm-sans: 'DM Sans', sans-serif;--wp--preset--font-family--domine: Domine, serif;--wp--preset--font-family--eb-garamond: 'EB Garamond', serif;--wp--preset--font-family--epilogue: Epilogue, sans-serif;--wp--preset--font-family--figtree: Figtree, sans-serif;--wp--preset--font-family--fira-sans: 'Fira Sans', sans-serif;--wp--preset--font-family--fraunces: Fraunces, serif;--wp--preset--font-family--ibm-plex-mono: 'IBM Plex Mono', monospace;--wp--preset--font-family--ibm-plex-sans: 'IBM Plex Sans', sans-serif;--wp--preset--font-family--inter: Inter, sans-serif;--wp--preset--font-family--josefin-sans: 'Josefin Sans', sans-serif;--wp--preset--font-family--jost: Jost, sans-serif;--wp--preset--font-family--libre-baskerville: 'Libre Baskerville', serif;--wp--preset--font-family--libre-franklin: 'Libre Franklin', sans-serif;--wp--preset--font-family--literata: Literata, serif;--wp--preset--font-family--lora: Lora, serif;--wp--preset--font-family--merriweather: Merriweather, serif;--wp--preset--font-family--montserrat: Montserrat, sans-serif;--wp--preset--font-family--newsreader: Newsreader, serif;--wp--preset--font-family--nunito: Nunito, sans-serif;--wp--preset--font-family--open-sans: 'Open Sans', sans-serif;--wp--preset--font-family--overpass: Overpass, sans-serif;--wp--preset--font-family--petrona: Petrona, serif;--wp--preset--font-family--piazzolla: Piazzolla, serif;--wp--preset--font-family--playfair-display: 'Playfair Display', serif;--wp--preset--font-family--plus-jakarta-sans: 'Plus Jakarta Sans', sans-serif;--wp--preset--font-family--poppins: Poppins, sans-serif;--wp--preset--font-family--raleway: Raleway, sans-serif;--wp--preset--font-family--roboto: Roboto, sans-serif;--wp--preset--font-family--roboto-slab: 'Roboto Slab', serif;--wp--preset--font-family--rubik: Rubik, sans-serif;--wp--preset--font-family--sora: Sora, sans-serif;--wp--preset--font-family--source-sans-3: 'Source Sans 3', sans-serif;--wp--preset--font-family--source-serif-4: 'Source Serif 4', serif;--wp--preset--font-family--space-mono: 'Space Mono', monospace;--wp--preset--font-family--texturina: Texturina, serif;--wp--preset--font-family--work-sans: 'Work Sans', sans-serif;--wp--preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5rem;--wp--preset--spacing--60: 2.25rem;--wp--preset--spacing--70: 3.38rem;--wp--preset--spacing--80: 5.06rem;--wp--preset--shadow--natural: 6px 6px 9px rgba(0, 0, 0, 0.2);--wp--preset--shadow--deep: 12px 12px 50px rgba(0, 0, 0, 0.4);--wp--preset--shadow--sharp: 6px 6px 0px rgba(0, 0, 0, 0.2);--wp--preset--shadow--outlined: 6px 6px 0px -3px rgba(255, 255, 255, 1), 6px 6px rgba(0, 0, 0, 1);--wp--preset--shadow--crisp: 6px 6px 0px rgba(0, 0, 0, 1);}:where(.is-layout-flex){gap: 0.5em;}:where(.is-layout-grid){gap: 0.5em;}body .is-layout-flow > .alignleft{float: left;margin-inline-start: 0;margin-inline-end: 2em;}body .is-layout-flow > .alignright{float: right;margin-inline-start: 2em;margin-inline-end: 0;}body .is-layout-flow > .aligncenter{margin-left: auto !important;margin-right: auto !important;}body .is-layout-constrained > .alignleft{float: left;margin-inline-start: 0;margin-inline-end: 2em;}body .is-layout-constrained > .alignright{float: right;margin-inline-start: 2em;margin-inline-end: 0;}body .is-layout-constrained > .aligncenter{margin-left: auto !important;margin-right: auto !important;}body .is-layout-constrained > :where(:not(.alignleft):not(.alignright):not(.alignfull)){max-width: var(--wp--style--global--content-size);margin-left: auto !important;margin-right: auto !important;}body .is-layout-constrained > .alignwide{max-width: var(--wp--style--global--wide-size);}body .is-layout-flex{display: flex;}body .is-layout-flex{flex-wrap: wrap;align-items: center;}body .is-layout-flex > *{margin: 0;}body .is-layout-grid{display: grid;}body .is-layout-grid > *{margin: 0;}:where(.wp-block-columns.is-layout-flex){gap: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-color{color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-color{color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-color{color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-color{color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-color{color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-color{color: var(--wp--preset--color--vivid-purple) !important;}.has-black-background-color{background-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-background-color{background-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-background-color{background-color: var(--wp--preset--color--white) !important;}.has-pale-pink-background-color{background-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-background-color{background-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-background-color{background-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-background-color{background-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-background-color{background-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-background-color{background-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-background-color{background-color: var(--wp--preset--color--vivid-purple) !important;}.has-black-border-color{border-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-border-color{border-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-border-color{border-color: var(--wp--preset--color--white) !important;}.has-pale-pink-border-color{border-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-border-color{border-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-border-color{border-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-border-color{border-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-border-color{border-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-border-color{border-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-border-color{border-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-border-color{border-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-border-color{border-color: var(--wp--preset--color--vivid-purple) !important;}.has-vivid-cyan-blue-to-vivid-purple-gradient-background{background: var(--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple) !important;}.has-light-green-cyan-to-vivid-green-cyan-gradient-background{background: var(--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan) !important;}.has-luminous-vivid-amber-to-luminous-vivid-orange-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange) !important;}.has-luminous-vivid-orange-to-vivid-red-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-orange-to-vivid-red) !important;}.has-very-light-gray-to-cyan-bluish-gray-gradient-background{background: var(--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray) !important;}.has-cool-to-warm-spectrum-gradient-background{background: var(--wp--preset--gradient--cool-to-warm-spectrum) !important;}.has-blush-light-purple-gradient-background{background: var(--wp--preset--gradient--blush-light-purple) !important;}.has-blush-bordeaux-gradient-background{background: var(--wp--preset--gradient--blush-bordeaux) !important;}.has-luminous-dusk-gradient-background{background: var(--wp--preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !important;}.has-midnight-gradient-background{background: var(--wp--preset--gradient--midnight) !important;}.has-small-font-size{font-size: var(--wp--preset--font-size--small) !important;}.has-medium-font-size{font-size: var(--wp--preset--font-size--medium) !important;}.has-large-font-size{font-size: var(--wp--preset--font-size--large) !important;}.has-x-large-font-size{font-size: var(--wp--preset--font-size--x-large) !important;}.has-albert-sans-font-family{font-family: var(--wp--preset--font-family--albert-sans) !important;}.has-alegreya-font-family{font-family: var(--wp--preset--font-family--alegreya) !important;}.has-arvo-font-family{font-family: var(--wp--preset--font-family--arvo) !important;}.has-bodoni-moda-font-family{font-family: var(--wp--preset--font-family--bodoni-moda) !important;}.has-cabin-font-family{font-family: var(--wp--preset--font-family--cabin) !important;}.has-chivo-font-family{font-family: var(--wp--preset--font-family--chivo) !important;}.has-commissioner-font-family{font-family: var(--wp--preset--font-family--commissioner) !important;}.has-cormorant-font-family{font-family: var(--wp--preset--font-family--cormorant) !important;}.has-courier-prime-font-family{font-family: var(--wp--preset--font-family--courier-prime) !important;}.has-crimson-pro-font-family{font-family: var(--wp--preset--font-family--crimson-pro) !important;}.has-dm-mono-font-family{font-family: var(--wp--preset--font-family--dm-mono) !important;}.has-dm-sans-font-family{font-family: var(--wp--preset--font-family--dm-sans) !important;}.has-domine-font-family{font-family: var(--wp--preset--font-family--domine) !important;}.has-eb-garamond-font-family{font-family: var(--wp--preset--font-family--eb-garamond) !important;}.has-epilogue-font-family{font-family: var(--wp--preset--font-family--epilogue) !important;}.has-figtree-font-family{font-family: var(--wp--preset--font-family--figtree) !important;}.has-fira-sans-font-family{font-family: var(--wp--preset--font-family--fira-sans) !important;}.has-fraunces-font-family{font-family: var(--wp--preset--font-family--fraunces) !important;}.has-ibm-plex-mono-font-family{font-family: var(--wp--preset--font-family--ibm-plex-mono) !important;}.has-ibm-plex-sans-font-family{font-family: var(--wp--preset--font-family--ibm-plex-sans) !important;}.has-inter-font-family{font-family: var(--wp--preset--font-family--inter) !important;}.has-josefin-sans-font-family{font-family: var(--wp--preset--font-family--josefin-sans) !important;}.has-jost-font-family{font-family: var(--wp--preset--font-family--jost) !important;}.has-libre-baskerville-font-family{font-family: var(--wp--preset--font-family--libre-baskerville) !important;}.has-libre-franklin-font-family{font-family: var(--wp--preset--font-family--libre-franklin) !important;}.has-literata-font-family{font-family: var(--wp--preset--font-family--literata) !important;}.has-lora-font-family{font-family: var(--wp--preset--font-family--lora) !important;}.has-merriweather-font-family{font-family: var(--wp--preset--font-family--merriweather) !important;}.has-montserrat-font-family{font-family: var(--wp--preset--font-family--montserrat) !important;}.has-newsreader-font-family{font-family: var(--wp--preset--font-family--newsreader) !important;}.has-nunito-font-family{font-family: var(--wp--preset--font-family--nunito) !important;}.has-open-sans-font-family{font-family: var(--wp--preset--font-family--open-sans) !important;}.has-overpass-font-family{font-family: var(--wp--preset--font-family--overpass) !important;}.has-petrona-font-family{font-family: var(--wp--preset--font-family--petrona) !important;}.has-piazzolla-font-family{font-family: var(--wp--preset--font-family--piazzolla) !important;}.has-playfair-display-font-family{font-family: var(--wp--preset--font-family--playfair-display) !important;}.has-plus-jakarta-sans-font-family{font-family: var(--wp--preset--font-family--plus-jakarta-sans) !important;}.has-poppins-font-family{font-family: var(--wp--preset--font-family--poppins) !important;}.has-raleway-font-family{font-family: var(--wp--preset--font-family--raleway) !important;}.has-roboto-font-family{font-family: var(--wp--preset--font-family--roboto) !important;}.has-roboto-slab-font-family{font-family: var(--wp--preset--font-family--roboto-slab) !important;}.has-rubik-font-family{font-family: var(--wp--preset--font-family--rubik) !important;}.has-sora-font-family{font-family: var(--wp--preset--font-family--sora) !important;}.has-source-sans-3-font-family{font-family: var(--wp--preset--font-family--source-sans-3) !important;}.has-source-serif-4-font-family{font-family: var(--wp--preset--font-family--source-serif-4) !important;}.has-space-mono-font-family{font-family: var(--wp--preset--font-family--space-mono) !important;}.has-texturina-font-family{font-family: var(--wp--preset--font-family--texturina) !important;}.has-work-sans-font-family{font-family: var(--wp--preset--font-family--work-sans) !important;}
:where(.wp-block-columns.is-layout-flex){gap: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}
.wp-block-pullquote{font-size: 1.5em;line-height: 1.6;}
.wp-block-navigation a:where(:not(.wp-element-button)){color: inherit;}
:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}
</style>
<link rel='stylesheet' id='dashicons-css' href='https://blog.trailofbits.com/wp-includes/css/dashicons.min.css?ver=6.4.3' media='all' />
<link rel='stylesheet' id='everyday-droid-serif-css' href='https://fonts-api.wp.com/css?family=Droid+Serif%3A400%2C700%2C400italic%2C700italic&#038;ver=20120328' media='all' />
<link rel='stylesheet' id='everyday-droid-sans-css' href='https://fonts-api.wp.com/css?family=Droid+Sans%3A400%2C700&#038;ver=20120328' media='all' />
<link rel='stylesheet' id='everyday-droid-mono-css' href='https://fonts-api.wp.com/css?family=Droid+Sans+Mono&#038;ver=20120328' media='all' />
<style id='jetpack-global-styles-frontend-style-inline-css'>
:root { --font-headings: unset; --font-base: unset; --font-headings-default: -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",sans-serif; --font-base-default: -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",sans-serif;}
</style>
<script type="text/javascript" id="jetpack_related-posts-js-extra">
/* <![CDATA[ */
var related_posts_js_options = {"post_heading":"h4"};
/* ]]> */
</script>
<script type='text/javascript'  src='https://blog.trailofbits.com/wp-content/plugins/jetpack/_inc/build/related-posts/related-posts.min.js?m=1687202188'></script>
<script type="text/javascript" src="https://blog.trailofbits.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1" id="jquery-core-js"></script>
<script type='text/javascript'  src='https://blog.trailofbits.com/wp-includes/js/jquery/jquery-migrate.min.js?m=1686289764'></script>
<link rel="https://api.w.org/" href="https://blog.trailofbits.com/wp-json/" /><link rel="alternate" type="application/json" href="https://blog.trailofbits.com/wp-json/wp/v2/posts/105140" /><link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://blog.trailofbits.com/xmlrpc.php?rsd" />

<link rel="canonical" href="https://blog.trailofbits.com/2023/09/25/pitfalls-of-relying-on-ebpf-for-security-monitoring-and-some-solutions/" />
<link rel='shortlink' href='https://blog.trailofbits.com/?p=105140' />
<link rel="alternate" type="application/json+oembed" href="https://blog.trailofbits.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fblog.trailofbits.com%2F2023%2F09%2F25%2Fpitfalls-of-relying-on-ebpf-for-security-monitoring-and-some-solutions%2F" />
<link rel="alternate" type="text/xml+oembed" href="https://blog.trailofbits.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fblog.trailofbits.com%2F2023%2F09%2F25%2Fpitfalls-of-relying-on-ebpf-for-security-monitoring-and-some-solutions%2F&#038;format=xml" />
			<!-- DO NOT COPY THIS SNIPPET! Start of Page Analytics Tracking for HubSpot WordPress plugin v11.0.3-->
			<script class="hsq-set-content-id" data-content-id="blog-post">
				var _hsq = _hsq || [];
				_hsq.push(["setContentType", "blog-post"]);
			</script>
			<!-- DO NOT COPY THIS SNIPPET! End of Page Analytics Tracking for HubSpot WordPress plugin -->
				<style>img#wpstats{display:none}</style>
		<style>
#page {
	background-color: #f7f7f7;
}
</style>

<meta name="description" content="By Artem Dinaburg eBPF (extended Berkeley Packet Filter) has emerged as the de facto Linux standard for security monitoring and endpoint observability. It is used by technologies such as BPFTrace, Cilium, Pixie, Sysdig, and Falco due to its low overhead and its versatility. There is, however, a dark (but open) secret: eBPF was never intended&hellip;" />
<style type="text/css" id="custom-background-css">
body.custom-background { background-image: url("https://blog.trailofbits.com/wp-content/themes/everyday/images/background.png"); background-position: left top; background-size: auto; background-repeat: repeat; background-attachment: scroll; }
</style>
	
<!-- Jetpack Open Graph Tags -->
<meta property="og:type" content="article" />
<meta property="og:title" content="Pitfalls of relying on eBPF for security monitoring (and some solutions)" />
<meta property="og:url" content="https://blog.trailofbits.com/2023/09/25/pitfalls-of-relying-on-ebpf-for-security-monitoring-and-some-solutions/" />
<meta property="og:description" content="By Artem Dinaburg eBPF (extended Berkeley Packet Filter) has emerged as the de facto Linux standard for security monitoring and endpoint observability. It is used by technologies such as BPFTrace, …" />
<meta property="article:published_time" content="2023-09-25T11:00:47+00:00" />
<meta property="article:modified_time" content="2023-09-22T13:02:16+00:00" />
<meta property="og:site_name" content="Trail of Bits Blog" />
<meta property="og:image" content="https://i0.wp.com/blog.trailofbits.com/wp-content/uploads/2020/07/cropped-android-chrome-512x512-1.png?fit=512%2C512&#038;ssl=1" />
<meta property="og:image:width" content="512" />
<meta property="og:image:height" content="512" />
<meta property="og:image:alt" content="" />
<meta property="og:locale" content="en_US" />
<meta name="twitter:creator" content="@trailofbits" />
<meta name="twitter:site" content="@trailofbits" />
<meta name="twitter:text:title" content="Pitfalls of relying on eBPF for security monitoring (and some solutions)" />
<meta name="twitter:image" content="https://i0.wp.com/blog.trailofbits.com/wp-content/uploads/2020/07/cropped-android-chrome-512x512-1.png?fit=240%2C240&amp;ssl=1" />
<meta name="twitter:card" content="summary" />

<!-- End Jetpack Open Graph Tags -->
<link rel="icon" href="https://i0.wp.com/blog.trailofbits.com/wp-content/uploads/2020/07/cropped-android-chrome-512x512-1.png?fit=32%2C32&#038;ssl=1" sizes="32x32" />
<link rel="icon" href="https://i0.wp.com/blog.trailofbits.com/wp-content/uploads/2020/07/cropped-android-chrome-512x512-1.png?fit=192%2C192&#038;ssl=1" sizes="192x192" />
<link rel="apple-touch-icon" href="https://i0.wp.com/blog.trailofbits.com/wp-content/uploads/2020/07/cropped-android-chrome-512x512-1.png?fit=180%2C180&#038;ssl=1" />
<meta name="msapplication-TileImage" content="https://i0.wp.com/blog.trailofbits.com/wp-content/uploads/2020/07/cropped-android-chrome-512x512-1.png?fit=270%2C270&#038;ssl=1" />
<style type="text/css" id="wp-custom-css">/*
Welcome to Custom CSS!

To learn how this works, see http://wp.me/PEmnE-Bt
*/
.entry-content {
	padding-left: 0;
}

.entry-content
blockquote {
	margin-left: 25px;
}

.entry-content
.embed {
	margin-left: 0;
}

.entry-content
.embed-youtube {
	margin-left: 0;
}

/* To remove the infinite scroll footer HC-23308875-SK */
#infinite-footer
{
  display:none;
}

.wp-caption 
.wp-caption-text {
	text-align: center;
}

@media only screen and ( max-width: 600px ) {
    body {
        margin: 0;
        padding: 10px;
        overflow: auto;
        width: 100%
    }
}</style><!-- Your Google Analytics Plugin is missing the tracking ID -->
</head>

<body class="post-template-default single single-post postid-105140 single-format-standard custom-background group-blog">
<div id="page" class="hfeed site">
		<header id="masthead" class="site-header" role="banner">
		<hgroup>
			<h1 class="site-title"><a href="https://blog.trailofbits.com/" title="Trail of Bits Blog" rel="home">Trail of Bits Blog</a></h1>
			<h2 class="site-description"></h2>
					</hgroup>

		<nav role="navigation" class="site-navigation main-navigation">
			<h1 class="assistive-text">Menu</h1>
			<div class="assistive-text skip-link"><a href="#content" title="Skip to content">Skip to content</a></div>
			<div class="menu"><ul>
<li ><a href="https://blog.trailofbits.com/">Home</a></li></ul></div>
		</nav>
	</header><!-- #masthead .site-header -->

	<div id="main" class="main">
		<div id="primary" class="site-content">
			<div id="content" role="main">

			
				
<article id="post-105140" class="post-105140 post type-post status-publish format-standard hentry category-guides category-linux entry">
	<header class="entry-header">

		<h1 class="entry-title">Pitfalls of relying on eBPF for security monitoring (and some solutions)</h1>
					<ul class="entry-meta">
				<li class="entry-format">Post</li>
				<li class="permalink"><a href="https://blog.trailofbits.com/2023/09/25/pitfalls-of-relying-on-ebpf-for-security-monitoring-and-some-solutions/" title="7:00 am" rel="bookmark"><time class="entry-date" datetime="2023-09-25T07:00:47-04:00" pubdate>September 25, 2023</time></a></li>
				<li class="comment-link"><a href="https://blog.trailofbits.com/2023/09/25/pitfalls-of-relying-on-ebpf-for-security-monitoring-and-some-solutions/#respond">Leave a comment</a></li>
							</ul><!-- .entry-meta -->
			</header><!-- .entry-header -->

	<div class="entry-content">
		<p><em><strong>By Artem Dinaburg</strong></em></p>
<p>eBPF (extended Berkeley Packet Filter) has emerged as the de facto Linux standard for security monitoring and endpoint observability. It is used by technologies such as BPFTrace, Cilium, Pixie, Sysdig, and Falco due to its low overhead and its versatility.</p>
<p>There is, however, a dark (but open) secret: <strong>eBPF was never intended for security monitoring. It is first and foremost a networking and debugging tool</strong>. As <a href="https://www.brendangregg.com/blog/2023-04-28/ebpf-security-issues.html" rel="noopener" target="_blank">Brendan Gregg observed</a>:</p>
<blockquote><p>eBPF has many uses in improving computer security, but just taking eBPF observability tools as-is and using them for security monitoring would be like driving your car into the ocean and expecting it to float.</p></blockquote>
<p>But eBPF is being used for security monitoring anyway, and developers may not be aware of the common pitfalls and under-reported problems that come with this use case. In this post, we cover some of these problems and provide workarounds. However, some challenges with using eBPF for security monitoring are inherent to the platform and cannot be easily addressed.</p>
<h2>Pitfall #1: eBPF probes are not invoked</h2>
<p>In theory, the kernel is never supposed to fail to fire eBPF probes. In practice, it does. <strong>Sometimes, although very rarely, the kernel will not fire eBPF probes when user code expects to see them</strong>. This behavior is not explicitly documented or acknowledged, but you can find <a href="https://github.com/iovisor/bcc/issues/2825" rel="noopener" target="_blank">hints of it in bug reports for eBPF tooling</a>.</p>
<p>This bug report provides valuable insight. First, the issues involved are rare and difficult to debug. Second, the kernel may be technically correct, but the observed behavior on the user side is missing events, even if the proximate behavior was different (e.g., too many probes). Comments on the bug report present two theories for why events are missing:</p>
<ul>
<li>First, there is a set limit on the number of kRetProbes that the kernel can have active at once. As of kernel 6.4.5, <a href="https://elixir.bootlin.com/linux/v6.4.5/source/kernel/trace/trace_kprobe.c#L26" rel="noopener" target="_blank">the default limit is 4,096</a>. Attempts to create more kRetProbes will fail, resulting in a missed event.</li>
<li>Second, the <a href="https://github.com/iovisor/bcc/issues/2825#issuecomment-602916367" rel="noopener" target="_blank">callback logic for a kProbe and a kRetProbe is slightly different</a>, which means that sometimes a kProbe will not see a matching kRetProbe, resulting in a missed event.</li>
</ul>
<p>More of these issues are likely lurking in the kernel, either as documented edge cases or surprise emergent effects of unrelated design decisions. <strong>eBPF is not a security monitoring mechanism, so there is not a guarantee that probes will fire as expected</strong>.</p>
<h3>Workarounds</h3>
<p>None. The callback logic and value for the maximum number of kRetProbes are hard-coded into the kernel. While one can manually edit and rebuild the kernel source, doing so is not advisable or feasible for most scenarios. Any tools relying on eBPF must be prepared for an occasional missing callback.</p>
<h2>Pitfall #2: Data is truncated due to space constraints</h2>
<p>An eBPF program’s stack space is limited to 512 bytes. When writing eBPF code, developers need to be particularly cautious about how much scratch data they use and the depth of their call stacks. This limit affects both the amount and kind of data that can be processed using eBPF code. For instance, 512 bytes is less than the longest permitted file path length, which is 4,096 bytes.</p>
<h3>Workarounds</h3>
<p>There are multiple options to get more scratch space, but they all involve cheating. Thanks to the <code>bpf_map_lookup_elem</code> helper, it&#8217;s possible to use a map’s memory directly. Directly using maps as storage effectively functions as <code>malloc</code>, but for eBPF code. A plausible implementation is a per-CPU array with a single key, whose size corresponds to our allocation needs:</p>
<pre>
u64 first_key = 0;
u8 *scratch_buffer = per_cpu_map.lookup(&first_key); // implemented with 
<strong>bpf_map_lookup_elem</strong>
</pre>
<p>However, how do we send this data back to our user mode code? A naive approach is to use even more maps, but this approach fails with variable-sized objects like paths and it also wastes memory. Maps can be very expensive in terms of memory use because data must be replicated per CPU to ensure integrity. Unfortunately, per-CPU maps allocate memory based on the <strong>number of possible hot-swappable CPUs</strong>. This number can easily be huge—on VMWare Fusion, it defaults to 128, so a single map entry wastes 127 times as much space as it uses.</p>
<p>Another approach is to stream data through the perf ring buffer. The <a href="https://github.com/trailofbits/linuxevents" rel="noopener" target="_blank"><code>linuxevents</code></a> library uses this method to handle variable paths. The following is an example pseudocode implementation of this approach:</p>
<pre>
u64 first_key = 0;
u8 *scratch_space = per_cpu_array.lookup(&first_key);
for (const auto &component_ptr : path.components()) {
  bpf_probe_read_str(scratch_space, component_ptr, scratch_space_size);
  perf_submit(scratch_space);
}
</pre>
<p>Streaming data through the <code>perf</code> ring buffer significantly increases the effective size of each component and also enhances space efficiency, albeit at the expense of additional data reconstruction work. To handle edge cases like untriggered probes or lost/overwritten data, a recovery method must be implemented after data transmission. Unfortunately, <code>perf</code> buffers are allocated in a similar way to per-CPU maps. On newer systems, the BPF ring buffer can be used instead to avoid that issue (the same ring buffer is shared across CPUs)</p>
<h2>Pitfall #3: Limited instruction count</h2>
<p>An eBPF program can have only 4,096 instructions, and reusing code (e.g., by defining a function) is not possible. Until recently, loops were not supported (or they had to be manually unrolled). While eBPF allows a maximum of 1 million instructions to be executed at runtime, the program can still be only 4,096 instructions long.</p>
<h3>Workarounds</h3>
<p>Rebuild your programs to take advantage of bounded loops (i.e., loops where the iteration count can be statically determined). These loops are now supported and they save precious program space compared to unrolling loops. Another workaround to increase the program size is multiple programs that tail call each other, which they can do up to 32 times until execution is interrupted. A drawback of this approach is that program state is lost between each transition. To keep state across tail calls, consider storing data in an eBPF map accessible by all 32 programs.</p>
<h2>Pitfall #4: Time-of-check to time-of-use issues</h2>
<p>An eBPF program can and will run concurrently on different CPU cores. This is true even for kernel code. Since there is no way to call kernel synchronization functions or to reliably acquire locks from eBPF, data races and time-of-check to time-of-use issues are a serious concern.</p>
<h3>Workarounds</h3>
<p>The only workaround is to carefully choose the event attach point, depending on the program. For example, eBPF commonly needs to work with functions that accept user data. In this situation, a good attach point is right after user data has been read into kernel mode.</p>
<p>When dealing with kernel code and synchronization is involved, you may not be able to mitigate time-of-check to time-of-use issues. As an example, <a href="https://www.kernel.org/doc/html/v5.0/filesystems/path-lookup.html" rel="noopener" target="_blank">the <code>dentry</code> structure that backs files</a> is often modified under lock by the kernel, and it is impossible to acquire these locks from an eBPF probe. Often the only indication that something is wrong is a bad return code from an API like <code>bpf_probe_read_user</code>. Make sure to handle such errors in a way that does not completely make the event data unusable. For example, if you are streaming data through <code>perf</code> in different packets, insert an error packet that notifies clients of missing data so that they can realign themselves to the event stream without causing corruption.</p>
<h2>Pitfall #5: Event overload</h2>
<p>Because eBPF lacks concurrency primitives and an eBPF probe cannot block the event producer, an attach point can be easily overwhelmed with events. This can lead to the following issues:</p>
<ol>
<li>Missed events, as the kernel stops calling the probe</li>
<li>Data loss due to the lack of storage space for new data</li>
<li>Data loss due to the complete overwriting of older but not yet consumed data by newer information</li>
<li>Data corruption from partial overwrites or complex data formats, disrupting normal program operation</li>
</ol>
<p>These data loss and corruption scenarios depend on the number of probes and events that are adding items into the event stream and on the extent of system activity. For instance, a docker container startup sequence or a deployment script can trigger a surprisingly large number of events. Developers should choose events to be monitored carefully and should avoid repetition and constructs that can make it harder to recover from data loss.</p>
<h3>Workarounds</h3>
<p>The user-mode helper should treat all data coming from eBPF probes as untrusted. This includes data from your own eBPF probes, which is also susceptible to accidental corruption. There should also be some application-level mechanism to detect missing or corrupted data.</p>
<h2>Pitfall #6: Page faults</h2>
<p>Memory that has not been accessed recently may be paged out to disk—be it a swap file, a backing file, or a more esoteric location. Normally, when this memory is needed, the kernel will issue a page fault, load the relevant content, and continue execution. For various reasons, eBPF runs with page faults disabled—if memory is paged out, it cannot be accessed. This is bad news for a security monitoring tool.</p>
<h3>Workarounds</h3>
<p>The only workaround is to hook right after a buffer is used and hope it does not get paged out before the probe reads it. This cannot be strictly guaranteed since there are no concurrency primitives, but the way the hook is implemented can increase the likelihood of success.</p>
<p>Consider the following example:</p>
<pre>
int syscall_name(const char *user_mode_ptr) {
  function1();
  function2(user_mode_ptr);
  function3()
  return 0;
}
</pre>
<p>To make sure that <code>user_mode_ptr</code> can be accessed, this code first hooks into the entry of <code>syscall_name</code> and saves all of the pointer parameters in a map. It then searches for a place where <code>user_mode_ptr</code> is almost certainly accessible (i.e., anything past the call to <code>function2</code>) and sets an attach point there to read the data. The following are some options for the attach point:</p>
<ol>
<li>On <code>function2</code> exit</li>
<li>On <code>function3</code> entry</li>
<li>On <code>function3</code> exit</li>
<li>On <code>syscall_name</code> exit</li>
</ol>
<p>You may be wondering why we don’t just hook <code>function2</code> directly. While this can work occasionally, it is normally a bad idea:</p>
<ol>
<li><code>function2</code> is often called outside of the context you are interested in (i.e., outside of <code>syscall_name</code>).</li>
<li><code>function2</code> may not have the same signature across kernel revisions. If we just use the function as an opaque breakpoint, signature changes do not affect our probe.</li>
</ol>
<p>Also note that, at times, the parameter changes during a system call, and we need to read it before the data is gone. For example, the <code>execve</code> system call replaces the entire process memory, erasing all initial data before the call completes.</p>
<p>Again, developers should assume that some memory may be unreadable by the eBPF probe and develop accordingly.</p>
<h2>Embracing benefits, addressing limitations</h2>
<p>eBPF is a powerful tool for Linux observability and monitoring, but it was not designed for security and comes with inherent limitations. Developers need to be aware of pitfalls like probe unreliability, data truncation, instruction limits, concurrency issues, event overload, and page faults. Workarounds exist, but they are imperfect and often add complexity.</p>
<p>The bottom line is that while eBPF enables exciting new capabilities, it is not a silver bullet. Software using eBPF for security monitoring must be built to gracefully handle missing data and error conditions. Robustness needs to be a top priority.</p>
<p>With care and creativity, eBPF can still be used to build next-generation security tools. But it requires acknowledging and working around eBPF&#8217;s constraints, not ignoring them. As with any technology, the most effective security monitoring solutions will embrace eBPF while being aware of how it can fail.</p>
<div class="sharedaddy sd-sharing-enabled"><div class="robots-nocontent sd-block sd-social sd-social-icon-text sd-sharing"><h3 class="sd-title">Share this:</h3><div class="sd-content"><ul><li class="share-twitter"><a rel="nofollow noopener noreferrer" data-shared="sharing-twitter-105140" class="share-twitter sd-button share-icon" href="https://blog.trailofbits.com/2023/09/25/pitfalls-of-relying-on-ebpf-for-security-monitoring-and-some-solutions/?share=twitter" target="_blank" title="Click to share on Twitter" ><span>Twitter</span></a></li><li class="share-linkedin"><a rel="nofollow noopener noreferrer" data-shared="sharing-linkedin-105140" class="share-linkedin sd-button share-icon" href="https://blog.trailofbits.com/2023/09/25/pitfalls-of-relying-on-ebpf-for-security-monitoring-and-some-solutions/?share=linkedin" target="_blank" title="Click to share on LinkedIn" ><span>LinkedIn</span></a></li><li class="share-reddit"><a rel="nofollow noopener noreferrer" data-shared="" class="share-reddit sd-button share-icon" href="https://blog.trailofbits.com/2023/09/25/pitfalls-of-relying-on-ebpf-for-security-monitoring-and-some-solutions/?share=reddit" target="_blank" title="Click to share on Reddit" ><span>Reddit</span></a></li><li class="share-telegram"><a rel="nofollow noopener noreferrer" data-shared="" class="share-telegram sd-button share-icon" href="https://blog.trailofbits.com/2023/09/25/pitfalls-of-relying-on-ebpf-for-security-monitoring-and-some-solutions/?share=telegram" target="_blank" title="Click to share on Telegram" ><span>Telegram</span></a></li><li class="share-facebook"><a rel="nofollow noopener noreferrer" data-shared="sharing-facebook-105140" class="share-facebook sd-button share-icon" href="https://blog.trailofbits.com/2023/09/25/pitfalls-of-relying-on-ebpf-for-security-monitoring-and-some-solutions/?share=facebook" target="_blank" title="Click to share on Facebook" ><span>Facebook</span></a></li><li class="share-pocket"><a rel="nofollow noopener noreferrer" data-shared="" class="share-pocket sd-button share-icon" href="https://blog.trailofbits.com/2023/09/25/pitfalls-of-relying-on-ebpf-for-security-monitoring-and-some-solutions/?share=pocket" target="_blank" title="Click to share on Pocket" ><span>Pocket</span></a></li><li class="share-email"><a rel="nofollow noopener noreferrer" data-shared="" class="share-email sd-button share-icon" href="mailto:?subject=%5BShared%20Post%5D%20Pitfalls%20of%20relying%20on%20eBPF%20for%20security%20monitoring%20%28and%20some%20solutions%29&body=https%3A%2F%2Fblog.trailofbits.com%2F2023%2F09%2F25%2Fpitfalls-of-relying-on-ebpf-for-security-monitoring-and-some-solutions%2F&share=email" target="_blank" title="Click to email a link to a friend" data-email-share-error-title="Do you have email set up?" data-email-share-error-text="If you&#039;re having problems sharing via email, you might not have email set up for your browser. You may need to create a new email yourself." data-email-share-nonce="17733fbd9a" data-email-share-track-url="https://blog.trailofbits.com/2023/09/25/pitfalls-of-relying-on-ebpf-for-security-monitoring-and-some-solutions/?share=email"><span>Email</span></a></li><li class="share-print"><a rel="nofollow noopener noreferrer" data-shared="" class="share-print sd-button share-icon" href="https://blog.trailofbits.com/2023/09/25/pitfalls-of-relying-on-ebpf-for-security-monitoring-and-some-solutions/#print" target="_blank" title="Click to print" ><span>Print</span></a></li><li class="share-end"></li></ul></div></div></div><div class='sharedaddy sd-block sd-like jetpack-likes-widget-wrapper jetpack-likes-widget-unloaded' id='like-post-wrapper-3681601-105140-65db5edfce39b' data-src='https://widgets.wp.com/likes/?ver=13.2-a.7#blog_id=3681601&amp;post_id=105140&amp;origin=blog.trailofbits.com&amp;obj_id=3681601-105140-65db5edfce39b&amp;n=1' data-name='like-post-frame-3681601-105140-65db5edfce39b' data-title='Like or Reblog'><h3 class="sd-title">Like this:</h3><div class='likes-widget-placeholder post-likes-widget-placeholder' style='height: 55px;'><span class='button'><span>Like</span></span> <span class="loading">Loading...</span></div><span class='sd-text-color'></span><a class='sd-link-color'></a></div>
<div id='jp-relatedposts' class='jp-relatedposts' >
	<h3 class="jp-relatedposts-headline"><em>Related</em></h3>
</div>			</div><!-- .entry-content -->

	<footer class="entry-footer">
		<p class="entry-byline">By Lauren Miorcec</p>
		<p class="cat-links">Posted in <a href="https://blog.trailofbits.com/category/guides/" rel="category tag">Guides</a>, <a href="https://blog.trailofbits.com/category/linux/" rel="category tag">Linux</a></p>
			</footer>
</article><!-- #post-105140 -->
						<nav role="navigation" id="nav-below" class="site-navigation post-navigation">
			<h1 class="assistive-text">Post navigation</h1>

		
			<div class="nav-previous"><a href="https://blog.trailofbits.com/2023/09/20/dont-overextend-your-oblivious-transfer/" rel="prev"><span class="meta-nav">&larr;</span> Don’t overextend your Oblivious Transfer</a></div>			<div class="nav-next"><a href="https://blog.trailofbits.com/2023/10/05/introducing-invariant-development-as-a-service/" rel="next">Introducing invariant development as a service <span class="meta-nav">&rarr;</span></a></div>
		
		</nav><!-- #nav-below -->
		
					<div id="comments" class="comments-area">
	
	
	
	
	
		<div id="respond" class="comment-respond">
			<h3 id="reply-title" class="comment-reply-title">Leave a Reply<small><a rel="nofollow" id="cancel-comment-reply-link" href="/2023/09/25/pitfalls-of-relying-on-ebpf-for-security-monitoring-and-some-solutions/#respond" style="display:none;">Cancel reply</a></small></h3>			<form id="commentform" class="comment-form">
				<iframe
					title="Comment Form"
					src="https://jetpack.wordpress.com/jetpack-comment/?blogid=3681601&#038;postid=105140&#038;comment_registration=0&#038;require_name_email=1&#038;stc_enabled=1&#038;stb_enabled=1&#038;show_avatars=1&#038;avatar_default=identicon&#038;greeting=Leave+a+Reply&#038;jetpack_comments_nonce=6258697bcb&#038;greeting_reply=Leave+a+Reply+to+%25s&#038;color_scheme=light&#038;lang=en_US&#038;jetpack_version=13.2-a.7&#038;show_cookie_consent=10&#038;has_cookie_consent=0&#038;is_current_user_subscribed=0&#038;token_key=%3Bnormal%3B&#038;sig=5c9334e7660bb5479ce7245e1ebf175bfa77cd92#parent=https%3A%2F%2Fblog.trailofbits.com%2F2023%2F09%2F25%2Fpitfalls-of-relying-on-ebpf-for-security-monitoring-and-some-solutions%2F"
											name="jetpack_remote_comment"
						style="width:100%; height: 430px; border:0;"
										class="jetpack_remote_comment"
					id="jetpack_remote_comment"
					sandbox="allow-same-origin allow-top-navigation allow-scripts allow-forms allow-popups"
				>
									</iframe>
									<!--[if !IE]><!-->
					<script>
						document.addEventListener('DOMContentLoaded', function () {
							var commentForms = document.getElementsByClassName('jetpack_remote_comment');
							for (var i = 0; i < commentForms.length; i++) {
								commentForms[i].allowTransparency = false;
								commentForms[i].scrolling = 'no';
							}
						});
					</script>
					<!--<![endif]-->
							</form>
		</div>

		
		<input type="hidden" name="comment_parent" id="comment_parent" value="" />

		
</div><!-- #comments .comments-area -->

			
			</div><!-- #content -->
		</div><!-- #primary .site-content -->

		<div id="secondary" class="widget-area" role="complementary">
						<aside id="search-4" class="widget widget_search">	<form method="get" id="searchform" action="https://blog.trailofbits.com/" role="search">
		<label for="s" class="assistive-text">Search</label>
		<input type="search" class="field" name="s" id="s" placeholder="Search &hellip;" />
		<input type="submit" class="submit" name="submit" id="searchsubmit" value="Search" />
	</form>
</aside><aside id="text-112416548" class="widget widget_text"><h1 class="widget-title">About Us</h1>			<div class="textwidget"><p>Since 2012, Trail of Bits has helped secure some of the world’s most targeted organizations and products. We combine high-­end security research with a real­ world attacker mentality to reduce risk and fortify code.</p>
<p>Read more at <a href="https://www.trailofbits.com">www.trailofbits.com</a></p>
</div>
		</aside><aside id="rss_links-4" class="widget widget_rss_links"><h1 class="widget-title">Subscribe via RSS</h1><p><a target="_self" href="https://blog.trailofbits.com/feed/" title="Subscribe to posts"><img src="https://blog.trailofbits.com/wp-content/plugins/jetpack/images/rss/red-small.png" alt="RSS feed" />&nbsp;RSS - Posts</a></p>
</aside>
		<aside id="recent-posts-5" class="widget widget_recent_entries">
		<h1 class="widget-title">Recent Posts</h1>
		<ul>
											<li>
					<a href="https://blog.trailofbits.com/2024/02/23/continuously-fuzzing-python-c-extensions/">Continuously fuzzing Python C extensions</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2024/02/20/breaking-the-shared-key-in-threshold-signature-schemes/">Breaking the shared key in threshold signature schemes</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2024/02/16/a-few-notes-on-aws-nitro-enclaves-images-and-attestation/">A few notes on AWS Nitro Enclaves: Images and attestation</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2024/02/14/cloud-cryptography-demystified-amazon-web-services/">Cloud cryptography demystified: Amazon Web Services</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2024/02/12/why-windows-cant-follow-wsl-symlinks/">Why Windows can’t follow WSL symlinks</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2024/02/09/master-fuzzing-with-our-new-testing-handbook-chapter/">Master fuzzing with our new Testing Handbook chapter</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2024/02/07/binary-type-inference-in-ghidra/">Binary type inference in Ghidra</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2024/02/05/improving-the-state-of-cosmos-fuzzing/">Improving the state of Cosmos fuzzing</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2024/02/02/chaos-communication-congress-37c3-recap/">Chaos Communication Congress (37C3) recap</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2024/01/31/introducing-differ-a-new-tool-for-testing-and-validating-transformed-programs/">Introducing DIFFER, a new tool for testing and validating transformed programs</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2024/01/26/enhancing-trust-for-sgx-enclaves/">Enhancing trust for SGX enclaves</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2024/01/25/we-build-x-509-chains-so-you-dont-have-to/">We build X.509 chains so you don’t have to</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2024/01/24/celebrating-our-2023-open-source-contributions/">Celebrating our 2023 open-source contributions</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2024/01/18/our-thoughts-on-aixccs-competition-format/">Our thoughts on AIxCC’s competition format</a>
									</li>
											<li>
					<a href="https://blog.trailofbits.com/2024/01/17/30-new-semgrep-rules-ansible-java-kotlin-shell-scripts-and-more/">30 new Semgrep rules: Ansible, Java, Kotlin, shell scripts, and more</a>
									</li>
					</ul>

		</aside><aside id="text-112416546" class="widget widget_text"><h1 class="widget-title">Yearly Archive</h1>			<div class="textwidget"><ul>
<li><a href="https://blog.trailofbits.com/2023">2023</a></li>
<li><a href="https://blog.trailofbits.com/2022">2022</a></li>
<li><a href="https://blog.trailofbits.com/2021">2021</a></li>
<li><a href="https://blog.trailofbits.com/2020">2020</a></li>
<li><a href="https://blog.trailofbits.com/2019">2019</a></li>
<li><a href="https://blog.trailofbits.com/2018">2018</a></li>
<li><a href="https://blog.trailofbits.com/2017">2017</a></li>
<li><a href="https://blog.trailofbits.com/2016">2016</a></li>
<li><a href="https://blog.trailofbits.com/2015">2015</a></li>
<li><a href="https://blog.trailofbits.com/2014">2014</a></li>
<li><a href="https://blog.trailofbits.com/2013">2013</a></li>
<li><a href="https://blog.trailofbits.com/2012">2012</a></li>
</ul></div>
		</aside><aside id="categories-4" class="widget widget_categories"><h1 class="widget-title">Categories</h1>
			<ul>
					<li class="cat-item cat-item-685590266"><a href="https://blog.trailofbits.com/category/aixcc/">AIxCC</a> (2)
</li>
	<li class="cat-item cat-item-291"><a href="https://blog.trailofbits.com/category/apple/">Apple</a> (13)
</li>
	<li class="cat-item cat-item-685590269"><a href="https://blog.trailofbits.com/category/application-security/">Application Security</a> (2)
</li>
	<li class="cat-item cat-item-141319"><a href="https://blog.trailofbits.com/category/attacks/">Attacks</a> (13)
</li>
	<li class="cat-item cat-item-685590231"><a href="https://blog.trailofbits.com/category/audits/">Audits</a> (9)
</li>
	<li class="cat-item cat-item-44620"><a href="https://blog.trailofbits.com/category/authentication/">Authentication</a> (6)
</li>
	<li class="cat-item cat-item-502354744"><a href="https://blog.trailofbits.com/category/binary-ninja/">Binary Ninja</a> (14)
</li>
	<li class="cat-item cat-item-64575263"><a href="https://blog.trailofbits.com/category/blockchain/">Blockchain</a> (60)
</li>
	<li class="cat-item cat-item-685590265"><a href="https://blog.trailofbits.com/category/c-c/">C/C++</a> (1)
</li>
	<li class="cat-item cat-item-1364812"><a href="https://blog.trailofbits.com/category/capture-the-flag/">Capture the Flag</a> (11)
</li>
	<li class="cat-item cat-item-685590242"><a href="https://blog.trailofbits.com/category/careers/">Careers</a> (2)
</li>
	<li class="cat-item cat-item-685590226"><a href="https://blog.trailofbits.com/category/codeql/">CodeQL</a> (5)
</li>
	<li class="cat-item cat-item-100030"><a href="https://blog.trailofbits.com/category/compilers/">Compilers</a> (26)
</li>
	<li class="cat-item cat-item-9204"><a href="https://blog.trailofbits.com/category/conferences/">Conferences</a> (31)
</li>
	<li class="cat-item cat-item-685590267"><a href="https://blog.trailofbits.com/category/confidential-computing/">Confidential Computing</a> (1)
</li>
	<li class="cat-item cat-item-182564"><a href="https://blog.trailofbits.com/category/containers/">Containers</a> (3)
</li>
	<li class="cat-item cat-item-25818"><a href="https://blog.trailofbits.com/category/cryptography/">Cryptography</a> (55)
</li>
	<li class="cat-item cat-item-28634997"><a href="https://blog.trailofbits.com/category/crytic/">Crytic</a> (4)
</li>
	<li class="cat-item cat-item-199448218"><a href="https://blog.trailofbits.com/category/cyber-grand-challenge/">Cyber Grand Challenge</a> (8)
</li>
	<li class="cat-item cat-item-55871"><a href="https://blog.trailofbits.com/category/darpa/">DARPA</a> (24)
</li>
	<li class="cat-item cat-item-4181544"><a href="https://blog.trailofbits.com/category/dynamic-analysis/">Dynamic Analysis</a> (15)
</li>
	<li class="cat-item cat-item-685590257"><a href="https://blog.trailofbits.com/category/ecosystem-security/">Ecosystem Security</a> (6)
</li>
	<li class="cat-item cat-item-1342"><a href="https://blog.trailofbits.com/category/education/">Education</a> (17)
</li>
	<li class="cat-item cat-item-551269408"><a href="https://blog.trailofbits.com/category/empire-hacking/">Empire Hacking</a> (7)
</li>
	<li class="cat-item cat-item-1360277"><a href="https://blog.trailofbits.com/category/engineering-practice/">Engineering Practice</a> (17)
</li>
	<li class="cat-item cat-item-924"><a href="https://blog.trailofbits.com/category/events/">Events</a> (8)
</li>
	<li class="cat-item cat-item-14563"><a href="https://blog.trailofbits.com/category/exploits/">Exploits</a> (30)
</li>
	<li class="cat-item cat-item-1643774"><a href="https://blog.trailofbits.com/category/fuzzing/">Fuzzing</a> (37)
</li>
	<li class="cat-item cat-item-2812"><a href="https://blog.trailofbits.com/category/go/">Go</a> (7)
</li>
	<li class="cat-item cat-item-320"><a href="https://blog.trailofbits.com/category/guides/">Guides</a> (15)
</li>
	<li class="cat-item cat-item-25357667"><a href="https://blog.trailofbits.com/category/internship-projects/">Internship Projects</a> (36)
</li>
	<li class="cat-item cat-item-96379492"><a href="https://blog.trailofbits.com/category/iverify/">iVerify</a> (5)
</li>
	<li class="cat-item cat-item-46713213"><a href="https://blog.trailofbits.com/category/kubernetes/">Kubernetes</a> (3)
</li>
	<li class="cat-item cat-item-610"><a href="https://blog.trailofbits.com/category/linux/">Linux</a> (5)
</li>
	<li class="cat-item cat-item-685590236"><a href="https://blog.trailofbits.com/category/machine-learning/">Machine Learning</a> (15)
</li>
	<li class="cat-item cat-item-15593"><a href="https://blog.trailofbits.com/category/malware/">Malware</a> (7)
</li>
	<li class="cat-item cat-item-1056516"><a href="https://blog.trailofbits.com/category/manticore/">Manticore</a> (17)
</li>
	<li class="cat-item cat-item-245013018"><a href="https://blog.trailofbits.com/category/mcsema/">McSema</a> (11)
</li>
	<li class="cat-item cat-item-685590263"><a href="https://blog.trailofbits.com/category/memory-safety/">Memory Safety</a> (1)
</li>
	<li class="cat-item cat-item-171"><a href="https://blog.trailofbits.com/category/meta/">Meta</a> (12)
</li>
	<li class="cat-item cat-item-6701995"><a href="https://blog.trailofbits.com/category/mitigations/">Mitigations</a> (11)
</li>
	<li class="cat-item cat-item-685590260"><a href="https://blog.trailofbits.com/category/open-source/">Open Source</a> (9)
</li>
	<li class="cat-item cat-item-293462444"><a href="https://blog.trailofbits.com/category/osquery/">osquery</a> (23)
</li>
	<li class="cat-item cat-item-208532"><a href="https://blog.trailofbits.com/category/paper-review/">Paper Review</a> (11)
</li>
	<li class="cat-item cat-item-685590244"><a href="https://blog.trailofbits.com/category/people/">People</a> (6)
</li>
	<li class="cat-item cat-item-685590238"><a href="https://blog.trailofbits.com/category/podcast/">Podcast</a> (1)
</li>
	<li class="cat-item cat-item-685590258"><a href="https://blog.trailofbits.com/category/policy/">Policy</a> (9)
</li>
	<li class="cat-item cat-item-6672"><a href="https://blog.trailofbits.com/category/press-release/">Press Release</a> (29)
</li>
	<li class="cat-item cat-item-3279"><a href="https://blog.trailofbits.com/category/privacy/">Privacy</a> (9)
</li>
	<li class="cat-item cat-item-1589"><a href="https://blog.trailofbits.com/category/products/">Products</a> (8)
</li>
	<li class="cat-item cat-item-5030448"><a href="https://blog.trailofbits.com/category/program-analysis/">Program Analysis</a> (18)
</li>
	<li class="cat-item cat-item-685590239"><a href="https://blog.trailofbits.com/category/recruitment/">Recruitment</a> (1)
</li>
	<li class="cat-item cat-item-685590241"><a href="https://blog.trailofbits.com/category/remote-work/">Remote Work</a> (1)
</li>
	<li class="cat-item cat-item-113884"><a href="https://blog.trailofbits.com/category/research-practice/">Research Practice</a> (23)
</li>
	<li class="cat-item cat-item-299073"><a href="https://blog.trailofbits.com/category/reversing/">Reversing</a> (16)
</li>
	<li class="cat-item cat-item-185574"><a href="https://blog.trailofbits.com/category/rust/">Rust</a> (7)
</li>
	<li class="cat-item cat-item-685590219"><a href="https://blog.trailofbits.com/category/safedocs/">SafeDocs</a> (1)
</li>
	<li class="cat-item cat-item-685590259"><a href="https://blog.trailofbits.com/category/semgrep/">Semgrep</a> (7)
</li>
	<li class="cat-item cat-item-685590218"><a href="https://blog.trailofbits.com/category/sinter/">Sinter</a> (1)
</li>
	<li class="cat-item cat-item-685590237"><a href="https://blog.trailofbits.com/category/slither/">Slither</a> (3)
</li>
	<li class="cat-item cat-item-401665"><a href="https://blog.trailofbits.com/category/sponsorships/">Sponsorships</a> (12)
</li>
	<li class="cat-item cat-item-538062"><a href="https://blog.trailofbits.com/category/static-analysis/">Static Analysis</a> (30)
</li>
	<li class="cat-item cat-item-685590262"><a href="https://blog.trailofbits.com/category/supply-chain/">Supply Chain</a> (4)
</li>
	<li class="cat-item cat-item-19674948"><a href="https://blog.trailofbits.com/category/symbolic-execution/">Symbolic Execution</a> (18)
</li>
	<li class="cat-item cat-item-685590268"><a href="https://blog.trailofbits.com/category/testing-handbook/">Testing Handbook</a> (3)
</li>
	<li class="cat-item cat-item-685590264"><a href="https://blog.trailofbits.com/category/threshold-signatures/">Threshold Signatures</a> (1)
</li>
	<li class="cat-item cat-item-943"><a href="https://blog.trailofbits.com/category/training/">Training</a> (2)
</li>
	<li class="cat-item cat-item-1"><a href="https://blog.trailofbits.com/category/uncategorized/">Uncategorized</a> (35)
</li>
	<li class="cat-item cat-item-685590261"><a href="https://blog.trailofbits.com/category/vulnerability-disclosure/">Vulnerability Disclosure</a> (18)
</li>
	<li class="cat-item cat-item-685590256"><a href="https://blog.trailofbits.com/category/windows/">Windows</a> (3)
</li>
	<li class="cat-item cat-item-685590240"><a href="https://blog.trailofbits.com/category/working-at-trail-of-bits/">Working at Trail of Bits</a> (2)
</li>
	<li class="cat-item cat-item-29911"><a href="https://blog.trailofbits.com/category/year-in-review/">Year in Review</a> (6)
</li>
	<li class="cat-item cat-item-685590235"><a href="https://blog.trailofbits.com/category/zero-knowledge/">Zero Knowledge</a> (10)
</li>
			</ul>

			</aside><aside id="twitter_timeline-3" class="widget widget_twitter_timeline"><a class="twitter-timeline" data-height="400" data-theme="light" data-border-color="#e8e8e8" data-tweet-limit="8" data-lang="EN" data-partner="jetpack" data-chrome="nofooter transparent" href="https://twitter.com/trailofbits" href="https://twitter.com/trailofbits">My Tweets</a></aside>		</div><!-- #secondary .widget-area -->

	</div><!-- #main -->

	<footer id="colophon" class="site-footer" role="contentinfo">
		<div class="site-info">
						
			
					</div><!-- .site-info -->
	</footer><!-- .site-footer .site-footer -->
</div><!-- #page .hfeed .site -->

<!--  -->
<style>
			.sd-social-icon .sd-content ul li a.sd-button>span {
				margin-left: 0;
			}
		</style><script defer id="bilmur" data-provider="wordpress.com" data-service="atomic"  src="https://s0.wp.com/wp-content/js/bilmur.min.js?m=202408"></script>
					<div class="jetpack-subscription-modal">
						<div class="jetpack-subscription-modal__modal-content">
								
	<div class="wp-block-group has-border-color jetpack-subscription-modal__modal-content-form" style="border-color:#dddddd;border-width:1px;margin-top:0;margin-bottom:0;padding:32px"><div class="wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow">

		
		<h2 class="wp-block-heading has-text-align-center" style="margin-top:4px;margin-bottom:10px;font-size:26px;font-style:normal;font-weight:600">Discover more from Trail of Bits Blog</h2>
		

		
		<p class='has-text-align-center' style='margin-top:4px;margin-bottom:0px;font-size:15px'>Subscribe now to keep reading and get access to the full archive.</p>
		

			<div class="wp-block-jetpack-subscriptions__supports-newline is-style-compact wp-block-jetpack-subscriptions">
		<div class="wp-block-jetpack-subscriptions__container is-not-subscriber">
			<form
				action="https://wordpress.com/email-subscriptions"
				method="post"
				accept-charset="utf-8"
				data-blog="3681601"
				data-post_access_level="everybody"
				data-subscriber_email=""
				id="subscribe-blog"
			>
				<div class="wp-block-jetpack-subscriptions__form-elements">
										<p id="subscribe-email">
						<label
							id="subscribe-field-label"
							for="subscribe-field"
							class="screen-reader-text"
						>
							Type your email…						</label>
						<input
								required="required"
								type="email"
								name="email"
								
								style="font-size: 16px;padding: 15px 23px 15px 23px;border-radius: 50px;border-width: 1px;"
								placeholder="Type your email…"
								value=""
								id="subscribe-field"
								
							/>					</p>
										<p id="subscribe-submit"
											>
						<input type="hidden" name="action" value="subscribe"/>
						<input type="hidden" name="blog_id" value="3681601"/>
						<input type="hidden" name="source" value="https://blog.trailofbits.com/2023/09/25/pitfalls-of-relying-on-ebpf-for-security-monitoring-and-some-solutions/"/>
						<input type="hidden" name="sub-type" value="subscribe-block"/>
						<input type="hidden" name="app_source" value="atomic-subscription-modal-lo"/>
						<input type="hidden" name="redirect_fragment" value="subscribe-blog"/>
						<input type="hidden" name="lang" value="en_US"/>
						<input type="hidden" id="_wpnonce" name="_wpnonce" value="2535e59485" /><input type="hidden" name="_wp_http_referer" value="/2023/09/25/pitfalls-of-relying-on-ebpf-for-security-monitoring-and-some-solutions/" /><input type="hidden" name="post_id" value="105140"/>						<button type="submit"
															class="wp-block-button__link"
																						style="font-size: 16px;padding: 15px 23px 15px 23px;margin: 0px; margin-left: 10px;border-radius: 50px;border-width: 1px;"
														name="jetpack_subscriptions_widget"
						>
							Subscribe						</button>
					</p>
				</div>
			</form>
					</div>
	</div>
	

		
		<p class="has-text-align-center jetpack-subscription-modal__close" style="margin-top:20px;font-size:14px"><a href="#">Continue reading</a></p>
		
	</div></div>
							</div>
					</div>
			
	<script type="text/javascript">
		window.WPCOM_sharing_counts = {"https:\/\/blog.trailofbits.com\/2023\/09\/25\/pitfalls-of-relying-on-ebpf-for-security-monitoring-and-some-solutions\/":105140};
	</script>
				<link rel='stylesheet' id='all-css-98242a1fae52bf2c367409ebb2b60d98' href='https://blog.trailofbits.com/wp-content/plugins/jetpack/_inc/blocks/subscriptions/view.css?m=1704222982' type='text/css' media='all' />
<script type="text/javascript" id="coblocks-tinyswiper-initializer-js-extra">
/* <![CDATA[ */
var coblocksTinyswiper = {"carouselPrevButtonAriaLabel":"Previous","carouselNextButtonAriaLabel":"Next","sliderImageAriaLabel":"Image"};
/* ]]> */
</script>
<script type='text/javascript'  src='https://blog.trailofbits.com/_static/??-eJyVjksOwjAMRC+EMYiqogvEUVBwospt4kSNSwSn5xMVFmxgNbLHbzwlAUVRJ4rJzz1LxsFpMjQuero4sXFCM2sMRpVpcYCD6R2QFbScFd/jesir8h1M8ewjjbleD58FGHmwyvFnsnbKqCxXyIWTm/5++mQrCiysbDzfXjHHcNi2XbfbNE27vwMcP226'></script>
<script type="text/javascript" id="leadin-script-loader-js-js-extra">
/* <![CDATA[ */
var leadin_wordpress = {"userRole":"visitor","pageType":"post","leadinPluginVersion":"11.0.3"};
/* ]]> */
</script>
<script type="text/javascript" src="https://js.hs-scripts.com/22554992.js?integration=WordPress&amp;ver=11.0.3" id="leadin-script-loader-js-js"></script>
<script type='text/javascript'  src='https://blog.trailofbits.com/_static/??-eJyVkctOAzEMRX+I1EU8ygbxKSgzcaeeOg8cp0P+vq40iwoVVHaJrs/1tb0UR2nkFrDCXCFQVThhCllgKa5k7ntithoU3URKm7k+LL8zghNaqdcsTlpSingHddXpqnrMSTEpFG4TpQpTs++AMsHQiAOEHJ2gDx0oBfz+g5xRix+PEHNobO3HHKPpFWob6ihUlHJypnp29ljlG+oPfz1gNDs8ofTg+2WsGr2ty/B2Y+bV2FIX7nfk/TR4HVYXUkVxl42yXeN/NNPREnw1bHjwKTDKyn/E98fd9u3p9Xn3sj0DDWXG8g=='></script>
<script type="text/javascript" src="https://stats.wp.com/e-202408.js" id="jetpack-stats-js" data-wp-strategy="defer"></script>
<script type="text/javascript" id="jetpack-stats-js-after">
/* <![CDATA[ */
_stq = window._stq || [];
_stq.push([ "view", JSON.parse("{\"v\":\"ext\",\"blog\":\"3681601\",\"post\":\"105140\",\"tz\":\"-5\",\"srv\":\"blog.trailofbits.com\",\"hp\":\"atomic\",\"ac\":\"2\",\"amp\":\"0\",\"j\":\"1:13.2-a.7\"}") ]);
_stq.push([ "clickTrackerInit", "3681601", "105140" ]);
/* ]]> */
</script>
<script defer type='text/javascript'  src='https://blog.trailofbits.com/wp-content/plugins/akismet/_inc/akismet-frontend.js?m=1704837122'></script>
<script type="text/javascript" id="jetpack-blocks-assets-base-url-js-before">
/* <![CDATA[ */
var Jetpack_Block_Assets_Base_Url="https://blog.trailofbits.com/wp-content/plugins/jetpack/_inc/blocks/";
/* ]]> */
</script>
<script type='text/javascript'  src='https://blog.trailofbits.com/wp-content/plugins/jetpack/_inc/blocks/subscriptions/view.js?m=1708369968'></script>
<script type="text/javascript" id="sharing-js-js-extra">
/* <![CDATA[ */
var sharing_js_options = {"lang":"en","counts":"1","is_stats_active":"1"};
/* ]]> */
</script>
<script type="text/javascript" src="https://blog.trailofbits.com/wp-content/plugins/jetpack/_inc/build/sharedaddy/sharing.min.js?ver=13.2-a.7" id="sharing-js-js"></script>
<script type="text/javascript" id="sharing-js-js-after">
/* <![CDATA[ */
var windowOpen;
			( function () {
				function matches( el, sel ) {
					return !! (
						el.matches && el.matches( sel ) ||
						el.msMatchesSelector && el.msMatchesSelector( sel )
					);
				}

				document.body.addEventListener( 'click', function ( event ) {
					if ( ! event.target ) {
						return;
					}

					var el;
					if ( matches( event.target, 'a.share-twitter' ) ) {
						el = event.target;
					} else if ( event.target.parentNode && matches( event.target.parentNode, 'a.share-twitter' ) ) {
						el = event.target.parentNode;
					}

					if ( el ) {
						event.preventDefault();

						// If there's another sharing window open, close it.
						if ( typeof windowOpen !== 'undefined' ) {
							windowOpen.close();
						}
						windowOpen = window.open( el.getAttribute( 'href' ), 'wpcomtwitter', 'menubar=1,resizable=1,width=600,height=350' );
						return false;
					}
				} );
			} )();
var windowOpen;
			( function () {
				function matches( el, sel ) {
					return !! (
						el.matches && el.matches( sel ) ||
						el.msMatchesSelector && el.msMatchesSelector( sel )
					);
				}

				document.body.addEventListener( 'click', function ( event ) {
					if ( ! event.target ) {
						return;
					}

					var el;
					if ( matches( event.target, 'a.share-linkedin' ) ) {
						el = event.target;
					} else if ( event.target.parentNode && matches( event.target.parentNode, 'a.share-linkedin' ) ) {
						el = event.target.parentNode;
					}

					if ( el ) {
						event.preventDefault();

						// If there's another sharing window open, close it.
						if ( typeof windowOpen !== 'undefined' ) {
							windowOpen.close();
						}
						windowOpen = window.open( el.getAttribute( 'href' ), 'wpcomlinkedin', 'menubar=1,resizable=1,width=580,height=450' );
						return false;
					}
				} );
			} )();
var windowOpen;
			( function () {
				function matches( el, sel ) {
					return !! (
						el.matches && el.matches( sel ) ||
						el.msMatchesSelector && el.msMatchesSelector( sel )
					);
				}

				document.body.addEventListener( 'click', function ( event ) {
					if ( ! event.target ) {
						return;
					}

					var el;
					if ( matches( event.target, 'a.share-telegram' ) ) {
						el = event.target;
					} else if ( event.target.parentNode && matches( event.target.parentNode, 'a.share-telegram' ) ) {
						el = event.target.parentNode;
					}

					if ( el ) {
						event.preventDefault();

						// If there's another sharing window open, close it.
						if ( typeof windowOpen !== 'undefined' ) {
							windowOpen.close();
						}
						windowOpen = window.open( el.getAttribute( 'href' ), 'wpcomtelegram', 'menubar=1,resizable=1,width=450,height=450' );
						return false;
					}
				} );
			} )();
var windowOpen;
			( function () {
				function matches( el, sel ) {
					return !! (
						el.matches && el.matches( sel ) ||
						el.msMatchesSelector && el.msMatchesSelector( sel )
					);
				}

				document.body.addEventListener( 'click', function ( event ) {
					if ( ! event.target ) {
						return;
					}

					var el;
					if ( matches( event.target, 'a.share-facebook' ) ) {
						el = event.target;
					} else if ( event.target.parentNode && matches( event.target.parentNode, 'a.share-facebook' ) ) {
						el = event.target.parentNode;
					}

					if ( el ) {
						event.preventDefault();

						// If there's another sharing window open, close it.
						if ( typeof windowOpen !== 'undefined' ) {
							windowOpen.close();
						}
						windowOpen = window.open( el.getAttribute( 'href' ), 'wpcomfacebook', 'menubar=1,resizable=1,width=600,height=400' );
						return false;
					}
				} );
			} )();
var windowOpen;
			( function () {
				function matches( el, sel ) {
					return !! (
						el.matches && el.matches( sel ) ||
						el.msMatchesSelector && el.msMatchesSelector( sel )
					);
				}

				document.body.addEventListener( 'click', function ( event ) {
					if ( ! event.target ) {
						return;
					}

					var el;
					if ( matches( event.target, 'a.share-pocket' ) ) {
						el = event.target;
					} else if ( event.target.parentNode && matches( event.target.parentNode, 'a.share-pocket' ) ) {
						el = event.target.parentNode;
					}

					if ( el ) {
						event.preventDefault();

						// If there's another sharing window open, close it.
						if ( typeof windowOpen !== 'undefined' ) {
							windowOpen.close();
						}
						windowOpen = window.open( el.getAttribute( 'href' ), 'wpcompocket', 'menubar=1,resizable=1,width=450,height=450' );
						return false;
					}
				} );
			} )();
/* ]]> */
</script>
	<iframe src='https://widgets.wp.com/likes/master.html?ver=20240225#ver=20240225&#038;n=1' scrolling='no' id='likes-master' name='likes-master' style='display:none;'></iframe>
	<div id='likes-other-gravatars' class='wpl-new-layout' role="dialog" aria-hidden="true" tabindex="-1"><div class="likes-text"><span>%d</span></div><ul class="wpl-avatars sd-like-gravatars"></ul></div>
			<script type="text/javascript">
			const iframe = document.getElementById( 'jetpack_remote_comment' );
						const watchReply = function() {
				// Check addComment._Jetpack_moveForm to make sure we don't monkey-patch twice.
				if ( 'undefined' !== typeof addComment && ! addComment._Jetpack_moveForm ) {
					// Cache the Core function.
					addComment._Jetpack_moveForm = addComment.moveForm;
					const commentParent = document.getElementById( 'comment_parent' );
					const cancel = document.getElementById( 'cancel-comment-reply-link' );

					function tellFrameNewParent ( commentParentValue ) {
						const url = new URL( iframe.src );
						if ( commentParentValue ) {
							url.searchParams.set( 'replytocom', commentParentValue )
						} else {
							url.searchParams.delete( 'replytocom' );
						}
						if( iframe.src !== url.href ) {
							iframe.src = url.href;
						}
					};

					cancel.addEventListener( 'click', function () {
						tellFrameNewParent( false );
					} );

					addComment.moveForm = function ( _, parentId ) {
						tellFrameNewParent( parentId );
						return addComment._Jetpack_moveForm.apply( null, arguments );
					};
				}
			}
			document.addEventListener( 'DOMContentLoaded', watchReply );
			// In WP 6.4+, the script is loaded asynchronously, so we need to wait for it to load before we monkey-patch the functions it introduces.
			document.querySelector('#comment-reply-js')?.addEventListener( 'load', watchReply );

			
			window.addEventListener( 'message', function ( event ) {
				if ( event.origin !== 'https://jetpack.wordpress.com' ) {
					return;
				}
				iframe.style.height = event.data + 'px';
			});
		</script>
		
</body>
</html>
<!--
	generated in 0.228 seconds
	83192 bytes batcached for 300 seconds
-->
